Comment by Xiulung

Yep, our app signing the commits would mean requiring your org to approve the app as "someone" who can contribute to the repo